CVE database
94,255 vulnerabilities, newest first. Each page breaks the severity score down in plain language and lists affected versions, exploitation status and the fix.
- 7.2 High severity
mbCONNECT24: Improper Neutralization of Special Elements used in an OS Command
A high privileged remote attacker can perform an OpenSSL code injection in the backends ImportPKCS12 function leading to code execution. This can result in a total loss of confidentiality, integrity and availability.
- 7.2 High severity
mbCONNECT24: Improper Neutralization of Special Elements used in an OS Command
A high privileged remote attacker can perform an OpenSSL code injection in the frontends device importer function leading to code execution. This can result in a total loss of confidentiality, integrity and availability.
- 7.2 High severity
mbCONNECT24: Improper Neutralization of Special Elements used in an OS Command
A high privileged remote attacker can perform a code injection in the backends patch activate function leading to code execution. This can result in a total loss of confidentiality, integrity and availability.
- 7.2 High severity
mbCONNECT24: Improper Neutralization of Special Elements used in an OS Command
A high privileged remote attacker can perform a code injection in the backends network auth function leading to code execution. This can result in a total loss of confidentiality, integrity and availability.
- 7.5 High severity
SAP Cloud SDK for Python: Improper Limitation of a Pathname to a Restricted Directory
The agent_memory module accepts a caller-supplied tenant parameter in create_client(tenant=...). Prior to version 0.50.0, the tenant parameter was not validated before being used to construct filesystem paths for secret resolution. A value containing path trav
- 7.5 High severity
SAP Cloud SDK for AI(JavaScript): Generation of Error Message Containing Sensitive Information
SAP Cloud SDK for AI (Node.js) could inadvertently include sensitive authentication credentials in error messages generated by certain internal operations under specific failure conditions. An attacker with low privileges and access to application logs or forw
- 7.2 High severity
ARMember Premium – Membership Plugin, Content…: Improper Neutralization of Input During Web Page Generation
The ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Registration Custom Field (Profile Cover) in all versions up to, and including, 7.8.1
- 7.2 High severity
Avada (Fusion) Builder: Improper Neutralization of Input During Web Page Generation
The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Form Notification Dynamic-Data action_hook → Media Upload Chain (ID3 Metadata / html_attributes) in all versions up to, and including, 3.16.1 due to insufficient i
- 8.1 High severity
WPML Multilingual CMS: Improper Authentication
The WPML Multilingual CMS plugin for WordPress is vulnerable to Authentication Bypass via Race Condition in versions up to, and including, 4.9.7. This is due to the `process_iframe_request` function's language-per-domain SSO handler generating the cross-domain
- 8.2 High severity
Everest Forms – Contact Form, Payment Form…: Improper Limitation of a Pathname to a Restricted Directory
The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to file deletion due to insufficient file path validation in the remove_csv_file_after_email_send function in all versions up to, and
- 7.5 High severity
Ultra Addons for Contact Form 7: Improper Limitation of a Pathname to a Restricted Directory
The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.5.54 via the uacf7_wpcf7_mail_components function. This makes it possible for unauthenticated attackers to read the contents o
- 8.3 High severity
AXIS A1210 - Secure Entry: Missing Authentication for Critical Functionality
A WebSocket request sent to a specific API endpoint allows unauthorized access to a separate API endpoint. This bypasses the intended authentication layer.
- 7.3 High severity
Hitachi Dynamic Link Manager for AIX: UNIX Symbolic Link (Symlink) Following
Insecure Temporary File Vulnerability in Hitachi Dynamic Link Manager for AIX (for markets outside Japan) and Hitachi Dynamic Link Manager EX for AIX (for the Japanese market). This issue affects Hitachi Dynamic Link Manager for AIX: from 7.4.1-00 before 9.0.4
- 7.0 High severity
Hitachi Dynamic Link Manager for AIX: Integer Overflow or Wraparound
Integer Overflow Vulnerability in Hitachi Dynamic Link Manager for AIX (for the Japanese market). This issue affects Hitachi Dynamic Link Manager for AIX: before 9.0.4-01.
- 8.1 High severity
Hitachi Dynamic Link Manager for Linux: Improper Link Resolution Before File Access
Improper Link Resolution Before File Access Vulnerability in Hitachi Dynamic Link Manager for Linux. This issue affects Hitachi Dynamic Link Manager for Linux: from 6.1.1.-00 before 9.0.5-00.
- 8.2 High severity
Hitachi Dynamic Link Manager for Linux: UNIX Symbolic Link (Symlink) Following
UNIX Symbolic Link (Symlink) Following Vulnerability in Hitachi Dynamic Link Manager for Linux. This issue affects Hitachi Dynamic Link Manager for Linux: from 8.6.2.-00 before 9.0.5-00.
- 7.9 High severity
Hitachi Dynamic Link Manager for Linux: UNIX Symbolic Link (Symlink) Following
UNIX Symbolic Link (Symlink) Following Vulnerability in Hitachi Dynamic Link Manager for Linux. This issue affects Hitachi Dynamic Link Manager for Linux: from 8.5.3.-00 before 9.0.5-00.
- 8.2 High severity
Hitachi Dynamic Link Manager for Linux: UNIX Symbolic Link (Symlink) Following
UNIX Symbolic Link (Symlink) Following Vulnerability in Hitachi Dynamic Link Manager for Linux. This issue affects Hitachi Dynamic Link Manager for Linux: from 8.6.2.-00 before 9.0.5-00.
- 7.0 High severity
Hitachi Dynamic Link Manager for Linux: Heap-based Buffer Overflow
Heap-based Buffer Overflow Vulnerability in Hitachi Dynamic Link Manager for Linux. This issue affects Hitachi Dynamic Link Manager for Linux: from 7.5.0-00 before 9.0.5-00.
- 7.8 High severity
Hitachi Dynamic Link Manager for Linux: Out-of-bounds Write
Out-of-Bounds Write Vulnerability in Hitachi Dynamic Link Manager for Linux. This issue affects Hitachi Dynamic Link Manager for Linux: from 7.5.0-00 before 9.0.5-00.
- 7.8 High severity
Hitachi Dynamic Link Manager for Linux: Incorrect Calculation of Buffer Size
Out-of-bounds Read and Write Vulnerability in Hitachi Dynamic Link Manager for Linux. This issue affects Hitachi Dynamic Link Manager for Linux: from 7.5.0-00 before 9.0.5-00.
- 7.1 High severity
Hitachi Dynamic Link Manager for VMware: Improper Neutralization of Special Elements used in an OS Command
OS Command Injection Vulnerability in Hitachi Dynamic Link Manager for VMware. This issue affects Hitachi Dynamic Link Manager for VMware: from 7.3.0-00 before 9.0.4-01.
- 8.1 High severity
Hitachi Dynamic Link Manager for VMware: Improper Neutralization of Special Elements used in an OS Command
OS Command Injection Vulnerability in Hitachi Dynamic Link Manager for VMware. This issue affects Hitachi Dynamic Link Manager for VMware: from 8.7.3-00 before 9.0.4-01.
- 8.1 High severity
Hitachi Dynamic Link Manager for VMware: Integer Overflow or Wraparound
Integer Overflow Vulnerability in Hitachi Dynamic Link Manager for VMware. This issue affects Hitachi Dynamic Link Manager for VMware: from 8.7.3-00 before 9.0.4-01.
- 8.1 High severity
Hitachi Dynamic Link Manager for VMware: Stack-based Buffer Overflow
Stack-based Buffer Overflow Vulnerability in Hitachi Dynamic Link Manager for VMware. This issue affects Hitachi Dynamic Link Manager for VMware: from 8.7.3-00 before 9.0.4-01.
- 8.2 High severity
Hitachi Dynamic Link Manager for Windows: Uncontrolled Search Path Element
Binary Planting Vulnerability in Hitachi Dynamic Link Manager for Windows. This issue affects Hitachi Dynamic Link Manager for Windows: from 5.9.5-00 before 9.0.4-01.
- 7.3 High severity
Hitachi Dynamic Link Manager for Windows: Improper Link Resolution Before File Access
Link Following Vulnerability in Hitachi Dynamic Link Manager for Windows. This issue affects Hitachi Dynamic Link Manager for Windows: from 5.0.0-03 before 9.0.4-01.
- 9.8 Critical severity
HiRDB Server Version 10: Partial String Comparison
Partial String Comparison Vulnerability in HiRDB. This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server Version 9: from 09-50-06 through 09-66-22; HiRDB Server with Additional Function Version 9: from 09-50-/F through 09-66/V; Hi
- 7.4 High severity
LimeSurvey Community Edition: Improper Neutralization of Input During Web Page Generation
LimeSurvey Community Edition 7.7.0 contains a stored cross-site scripting vulnerability in the Central Participants Database blocklist control. An authenticated user with only global participantpanel:import permission can import a CSV participant_id containing
- 8.8 High severity
DIAEnergie: Improper Neutralization of Special Elements used in an SQL Command
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Deltaww DIAEnergie allows SQL Injection. This issue affects DIAEnergie: before 1.11.01.032.
- 8.7 High severity
Router firmware: Improper Neutralization of Special Elements used in an OS Command
Improper neutralization of special elements used in an OS command in certain ASUS Router firmware allows an unauthenticated nearby user to trigger a chain of actions—unauthenticated queries, identifier guessing, credential overwriting, and command injection—re
- 7.0 High severity
Router firmware: Improper Neutralization of Special Elements used in an OS Command
Improper neutralization of special elements used in an OS command in certain ASUS Router firmware allows an user with physical access to insert a USB device containing a specially crafted directory name, potentially executing arbitrary commands with root privi
- 7.1 High severity
Router firmware: Out-of-bounds Write
An out-of-bounds write in certain ASUS Router firmware allows an unauthenticated nearby user to send an HTTP request containing parameters that exceed the buffer length, potentially overwriting other memory regions or causing the system to crash. Refer to the
- 10.0 Critical severity
SAP Web Dispatcher: Heap-based Buffer Overflow
SAP Web Dispatcher does not sufficiently validate certain network input processed by an internal component. An unauthenticated attacker could send specially crafted network traffic to trigger a memory corruption condition in the affected functionality. Success
- 9.6 Critical severity
SAP Web Dispatcher and Internet Communication…: Cross-Site Request Forgery
SAP Web Dispatcher and SAP NetWeaver Application Server ABAP (Internet Communication Manager) do not perform sufficient request validation in certain administrative functionality. In the context of Application Server ABAP and SAP Web Dispatcher, an unauthentic
- 7.5 High severity
SAP NetWeaver AS Java EDM Application: Missing Authorization
SAP NetWeaver AS Java EDM Application does not perform an authentication check for certain web service requests. An unauthenticated attacker could send a specially crafted request to retrieve sensitive business information. This results in a high impact on con
- 10.0 Critical severity
SAP Gateway: Incorrect Authorization
SAP Gateway activates the default Access Control List with high privileges allowing categorization of external attacker as internal application server. As a result an unauthenticated attacker with network access to the SAP Gateway could exploit this weakness t
- 7.5 High severity
SAP NetWeaver and ABAP Platform (SAP Message…: Integer Overflow or Wraparound
Due to a Memory Corruption vulnerability in Application Server ABAP of SAP NetWeaver and ABAP Platform, an unauthenticated attacker could send specially crafted network requests to the affected service. By triggering the vulnerability, the attacker could cause
- 7.5 High severity
SAP NetWeaver and ABAP Platform: Out-of-bounds Write
Due to a Memory Corruption vulnerability in Application Server ABAP for SAP NetWeaver and ABAP Platform, an unauthenticated attacker could send specially crafted requests to the application. If processed by the application, these requests could trigger a memor
- 8.9 High severity
SAP NetWeaver and ABAP Platform: Authentication Bypass by Capture-replay
Due to improper RFC protocol validation in the SAP Kernel used by the Application Server ABAP of SAP NetWeaver and ABAP Platform, an unauthenticated attacker can send a crafted RFC request that exploits logical errors in memory management, leading to memory co